Blog
/
Email
/
April 17, 2023

Boosting Security Posture with Email Integration

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
17
Apr 2023
Protect your organization from cyber-attacks with a strong security strategy. Learn how to safeguard against threats targeting email, cloud apps, and beyond.

On its own, Darktrace/Email™ stops attacks before they reach an employee’s inbox and considers both security teams and the employees themselves. But its value extends beyond email security, increased by its ability to integrate with the wider security ecosystem, including both Darktrace products and external tools. 

Darktrace’s understanding of you and your organization can be applied anywhere your company has data. This unifying approach to cyber security feeds AI outputs into each other, from threat prevention to detection and response, in order to harden the entire security posture autonomously and continuously. The AI also enriches other security solutions an organization has in place by both ingesting and sharing data. This degree of integration transforms a security stack so that it is greater than the sum of its parts. 

Integrating Beyond Email to Enhance Detection and Response 

Integrating email security with other areas of the digital estate bolsters defenses, while reducing required resources. With more data, security teams gain a better understanding of the security stack and how attacks move through the system.

Traditional security solutions do this by either manually aggregating inputs from various tools or using a SIEM without native integrations to collate data. In contrast, Darktrace’s integration provides real-time intelligence communications between products to inform security teams. 

For example, context of network activity can provide more holistic email security. There’s a strong correlation between the websites users visit and the people that they email, which means information like web traffic provides insight into email threats, and vice versa. 

If an organization receives an email from a strange new sender, that happens to be have been sent from a domain nobody has ever visited, that added context could influence the aggression levels of actions taken. Integrations with endpoint security extends this type of informed decision-making to remote environments. These examples highlight the patented power of Darktrace/Network™ and Darktrace/Endpoint™ when paired with email coverage. 

Diagram depicting the flow of email activity generated by Darktrace Email Security tool.
Figure 2. Darktrace/Email works with Darktrace/Network and Darktrace/Endpoint to generate email insights from web traffic and vice versa. 

Email activity is tied to cloud/SaaS application account activity in an even more direct way. In the case of an account takeover, a suspicious Microsoft 365 login becomes even more suspicious if it is followed by highly unusual email activity, like new inbox rules being created. Too many email security solutions focus on the inbox alone, but viewing these areas in a single scope is critical for security teams wanting to understand the full timeline of an incident. 

To this end, Darktrace creates a 360-degree view of each user and their behavior. This comprehensive view goes beyond native security monitoring tools, allowing security teams to identify instances of data exfiltration, human error, misdirected emails, inappropriate link sharing, unusual log activity, and more. 

In one real-life example, the security team saw an attack from both an email and a SaaS perspective to quickly understand the whole picture, thanks to Darktrace/Email and Darktrace/Apps™. 

Darktrace customers are getting significant value from this integrated security stack. “The whole suite of products has given us 100% visibility across our whole ecosystem, which is fantastic. A lot of times we need to use many products to do that, and with the Darktrace products, I have that all in one,” commented a vice president of enterprise security and fraud management at a major credit union. 

Siloed solutions are a massive pain point in the cyber industry. Most companies have several, layered tools in their security stacks. When there is little to no communication between them, the security team must contend with an inflated workload and misses out on value. They must learn how to navigate several different dashboards, translate between languages and terms, and manually correlate data, in addition to monitoring all the solutions daily. This process makes maintaining security more difficult for the team, especially in a threat landscape with increasingly complex and fast-paced attacks. 

By sending and collecting information to and from other tools that the security team already uses, whether they are a part of Darktrace’s product stack or not, Darktrace/Email optimizes workflows so security teams can reallocate resources to larger, more strategic projects.  

Collaborating Across Email Security and Cyber Risk Management Tools

Syncing email protections with cyber risk management tools even further reduces risk and hardens security.

When emails are received from domain names associated with the brand of the client, an attack surface management tool can automatically analyze if those domains should be included as part of the attack surface scope or trigger malicious domain responses. 

In the other direction, when the attack surface management tool identifies malicious assets, like suspicious domains, spoofing sites, and typo squatters, it can inform email security decisions. With integrations between tools, these malicious assets automatically become watched domains with heightened sensitivity for inbound email. 

This integrated risk reduction can occur internally as well. When security teams look at cyber risk from an internal perspective, they may identify attack paths and high value targets within the company’s digital estate. By leveraging this understanding, Darktrace can determine which employees are critical components of potential attack paths. Once determined, the AI can test them by creating phishing simulations using details like real-life communication patterns and calendar data. These tests generate insights that feed back into Darktrace/Email to harden the environment, for example by heightening sensitivity. 

This demonstrates the benefits of combining Darktrace/Email and Darktrace PREVENT™. As part of the Cyber AI Loop, these connections between email security and cyber risk management are made easy for the security team to understand and act on. One customer noted how this integration had improved its security team’s workflow.  

“The more you use of Darktrace, the better it can correlate on your behalf,” said a Chief Information Officer at a construction company. “That’s why we’re all in with Darktrace now. We now have a holistic Darktrace footprint, which benefits us because we have more of the modules working on our behalf and not having to do the correlations separately or in isolation.” 

Supporting Compatibility with External Security Solutions

Darktrace/Email also works together with external tools. In addition to its mature integration with email providers like Microsoft 365 and Google Workspaces, Darktrace/Email has an open architecture that makes it immensely flexible. It is both API-driven and compatible with syslog, so it can integrate with any security tool and feed into any SIEM or SOAR. 

This unlimited capacity for integration allows Darktrace to detect and respond to threats more precisely with access to more data, as well as reduce the security team’s time-to-meaning by putting all relevant information in a single pane of glass. 

Darktrace/Email is also part of the Darktrace Mobile App, so security teams can view notifications, reports, and remediation actions at any time, even on the go. In this way, Darktrace not only fits into the greater security posture, but also with employees’ day-to-day workflow. 

Finally, Darktrace/Email supports data exports. These translate and share the data it collects within the email environment, allowing the security team to communicate key takeaways generated by Darktrace/Email to anyone within the organization. It can export directly to Microsoft Excel, or any other data analytics tool. This is especially useful for security teams as they work with other departments like IT, compliance, finance, and more. 

Integrations Add Value to the Darktrace Partnership

While Darktrace/Email is a powerful tool on its own, a major source of its value comes from its compatibility with the rest of Darktrace, other tools, people, and processes. 

Deploying multiple Darktrace products builds a robust security ecosystem that enhances detection while breaking down silos and improving workflows, therefore enabling the security team to take on higher-level and more strategic work. By integrating with external tools, Darktrace not only increases its own value but also maximizes the return on investment of other security solutions a team already has.  

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Dan Fein
VP, Product

Based in New York, Dan joined Darktrace’s technical team in 2015, helping customers quickly achieve a complete and granular understanding of Darktrace’s product suite. Dan has a particular focus on Darktrace/Email, ensuring that it is effectively deployed in complex digital environments, and works closely with the development, marketing, sales, and technical teams. Dan holds a Bachelor’s degree in Computer Science from New York University.

Carlos Gray
Product Manager

Carlos Gonzalez Gray is a Product Marketing Manager at Darktrace, based in the Madrid Office. As an email security Subject Matter Expert he collaborates with the global product team to align each product with the company’s ethos and ensures Darktrace are continuously pushing the boundaries of innovation. His prior role at Darktrace was in Sales Engineering, leading the Iberian team and specializing in both the email and OT sectors. Additionally, his prior experience as a consultant to IBEX 35 companies in Spain has made him well-versed in compliance, auditing, and data privacy. Carlos holds an Honors BA in Political Science and a Masters in Cybersecurity from IE University.

Book a 1-1 meeting with one of our experts
Share this article

Blog

/

Network

/

March 21, 2025

Cyberhaven Supply Chain Attack: Exploiting Browser Extensions

Default blog imageDefault blog image

The evolution of supply chain attacks

Supply chain attacks are becoming increasingly sophisticated. As network defenses improve, threat actors continuously adapt and refine their tactics, techniques, and procedures (TTPs) to achieve their goals. In recent years, this has led to a rise in the exploitation of trusted services and software, including legitimate browser extensions. Exploitation of these extensions can provide adversaries with a stealthy means to infiltrate target networks and access high-value accounts undetected.

A notable example of this trend was the compromise of the Cyberhaven Chrome extension at the end of 2024. This incident appeared to be part of a broader campaign targeting multiple Chrome browser extensions, highlighting the evolving nature of supply chain attacks [1].

What is Cyberhaven?

Cyberhaven, a US-based data security organization, experienced a security breach on December 24, 2024, when a phishing attack reportedly compromised one of their employee's credentials [2]. This allowed attackers to publish a malicious version of the Cyberhaven Chrome extension, which exfiltrated cookies and authenticated sessions from targeted websites. The malicious extension was active from December 25 to December 26 – a time when most businesses and employees were out of office and enjoying the festive period, a fact not lost on threat actors. The attackers, likely a well-organized and financially motivated group, compromised more than 30 additional Chrome extensions, affecting more than 2.6 million users [3]. They used sophisticated phishing techniques to authorize malicious OAuth applications, bypassing traditional security measures and exploiting vulnerabilities in OAuth authorizations. The primary motive appeared to be financial gain, targeting high-value platforms like social media advertising and AI services [4].

In late December 2024, multiple Darktrace customers were compromised via the Cyberhaven Chrome extension; this blog will primarily focus on Darktrace / NETWORK detections from one affected customer.

Darktrace’s coverage of Cyberhaven compromises

On December 26, 2024, Darktrace identified a series of suspicious activities across multiple customer environments, uncovering a structured attack sequence that progressed from initial intrusion to privilege escalation and data exfiltration. The attack was distributed through a malicious update to the Cyberhaven Chrome extension [2]. The malicious update established a foothold in customer environments almost immediately, leading to further anomalies.

As with other Chrome browser extensions, Cyberhaven Chrome extensions were updated automatically with no user interaction required. However, in this instance, the automatic update included a malicious version which was deployed to customer environments. This almost immediately introduced unauthorized activity, allowing attackers to establish a foothold in customer networks. The update allowed attackers to execute their objectives in the background, undetected by traditional security tools that rely on known indicators of compromise (IoCS) rather than identifying anomalies.

While multiple customer devices were seen connecting to cyberhaven[.]io, a legitimate Cyberhaven domain, Darktrace detected persistent beaconing behavior to cyberhavenext[.]pro, which appeared to be attempting to masquerade as another legitimate Cyberhaven domain. Darktrace recognized this activity as unusual, triggering several model alerts in Darktrace / NETWORK to highlight the persistent outbound connections to the suspicious domain.

Further analysis of external connectivity patterns indicated  an increase in anomalous HTTP requests alongside this beaconing activity. Multiple open-source intelligence (OSINT) sources also suggest that the cyberhavenext[.]pro endpoint is associated with malicious activities [5].

Darktrace / NETWORK’s detection of beaconing activity to cyberhavenext[.]pro
Figure 1: Darktrace / NETWORK’s detection of beaconing activity to cyberhavenext[.]pro

Analysis using Darktrace’s Advanced Search revealed that some of these connections were directed to the suspicious external IP address 149.28.124[.]84. Further investigation confirmed that the IP correlated with two SSL hostnames, including the malicious cyberhavenext[.]pro, further reinforcing its connection to the attack infrastructure.

Darktrace Advanced Search analysis showing the IP address 149.28.124[.]84 correlating to two SSL hostnames, one of which is cyberhavenext[.]pro.
Figure 2: Darktrace Advanced Search analysis showing the IP address 149.28.124[.]84 correlating to two SSL hostnames, one of which is cyberhavenext[.]pro.

Between December 23 and December 27, Darktrace observed sustained beaconing-like activity from affected devices on the customer’s network.

Darktrace’s detection of beaconing activities from a customer device to the endpoint 149.28.124[.]84 between December 23 and December 27.
Figure 3: Darktrace’s detection of beaconing activities from a customer device to the endpoint 149.28.124[.]84 between December 23 and December 27.

Darktrace observed 27 unique devices connecting to the malicious command-and-control (C2) infrastructure as far back as December 3. While most connections were brief, they represented an entry point for malicious activity. Over a two-day period, two devices transmitted 5.57 GiB of incoming data and 859.37 MiB of outgoing data, generating over 3 million log events across SSL, HTTP, and connection data.

Subsequent analysis identified a significant increase in unauthorized data transfers to the aforementioned 149.28.124[.]84 IP on another customer network, highlighting the potential broader impact of this compromise. The volume and frequency of these transfers suggested that attackers were leveraging automated data collection techniques, further underscoring the sophistication of the attack.

Darktrace’s detection of the likely exfiltration of 859.37 MiB to the endpoint 149.28.124[.]84.
Figure 4: Darktrace’s detection of the likely exfiltration of 859.37 MiB to the endpoint 149.28.124[.]84.

External research suggested that once active, the Cyberhaven extension would begin silently collecting session cookies and authentication tokens, specifically targeting high-value accounts such as Facebook Ads accounts [4]. Darktrace’s analysis of another affected customer noted many HTTP POST connections directed to a specific URI ("ai-cyberhaven"), while GET requests contained varying URIs prefixed with "/php/urlblock?args=AAAh....--redirect." This activity indicated an exfiltration mechanism, consistent with techniques observed in other compromised Chrome extensions. By compromising session cookies, attackers could potentially gain administrative access to connected accounts, further escalating their privileges [4].

Conclusion

This incident highlights the importance of monitoring not just endpoint security, but also cloud and browser-based security solutions, as attackers increasingly target these trusted and oft overlooked vectors.

Ultimately, by focusing on anomaly detection and behavioral analysis rather than static signatures and lists of ‘known bads’, Darktrace was able to successfully detect devices affected by the Cyberhaven Chrome browser extension compromise, by identifying activity that would likely have been considered legitimate and benign by traditional security solutions.

This compromise also serves as a reminder that supply chain attacks are not limited to traditional software vendors. Browser extensions, cloud-based applications, and SaaS services are equally vulnerable, as evidenced by Darktrace's detection of Balada Injector malware exploiting WordPress vulnerabilities to gain unauthorized network access [6]. Therefore, increased targeting of browser-based security tools, and a greater exploitation of OAuth and session hijacking techniques are to be expected. Attackers will undoubtedly refine their methods to infiltrate legitimate vendors and distribute malicious updates through trusted channels. By staying informed, vigilant, and proactive, organizations can mitigate exposure to evolving supply chain threats and safeguard their critical assets from emerging browser-based attack techniques.

Credit to Rajendra Rushanth (Cyber Analyst) Justin Torres (Senior Cyber Analyst) and Ryan Traill (Analyst Content Lead)

Appendices

Darktrace Model Detections

·       Compromise / Beaconing Activity To External Rare (AP: C2 Comms)

·       Compromise / Beacon for 4 Days (AP: C2 Comms)

·       Compromise / HTTP Beaconing to Rare Destination (AP: C2 Comms)

·       Device / Suspicious Domain (AP: C2 Comms, AP: Tooling)

·       Compromise / Sustained TCP Beaconing Activity To Rare Endpoint (AP: C2 Comms)

·       Anomalous Server Activity / Rare External from Server (AP: C2 Comms)

·       Anomalous Connection / Multiple Failed Connections to Rare Endpoint (AP: C2 Comms)

·       Anomalous Server Activity / Anomalous External Activity from Critical Network Device (AP: C2 Comms)

·       Compromise / Slow Beaconing Activity To External Rare (AP: C2 Comms)

·       Compromise / Repeating Connections Over 4 Days (AP: C2 Comms)

·       Anomalous Connection / Multiple HTTP POSTs to Rare Hostname (AP: C2 Comms)

·       Anomalous Server Activity / Outgoing from Server (AP: C2 Comms)

·       Compromise / High Volume of Connections with Beacon Score (AP: C2 Comms)

·       Compromise / Large Number of Suspicious Failed Connections (AP: C2 Comms)

·       Email Nexus / Connection to Hijacked Correspondent Link

·       Compromise / Suspicious TLS Beaconing To Rare External (AP: C2 Comms)

·       Compromise / Quick and Regular Windows HTTP Beaconing (AP: C2 Comms)

List of IoCs

IoC - Type - Description + Confidence

cyberhavenext[.]pro - Hostname - Used for C2 communications and data exfiltration (cookies and session tokens)

149.28.124[.]84 - IP - Associated with malicious infrastructure

45.76.225[.]148 - IP - Associated with malicious infrastructure

136.244.115[.]219 - IP - Associated with malicious infrastructure

MITRE ATT&CK Mapping

Tactic – Technique – Sub-Technique

INITIAL ACCESS - T1176 - Browser Extensions

EXECUTION - T1204.002 - Malicious Browser Extensions

PERSISTENCE - T1176 - Browser Extensions

COMMAND AND CONTROL - T1071.001 - Web Protocols

COMMAND AND CONTROL - T1001 - Data Obfuscation

CREDENTIAL ACCESS - T1539 - Steal Web Session Cookie

DISCOVERY - T1518.001 - Security Software Discovery

LATERAL MOVEMENT - T1557.003 - Man-in-the-Browser

EXFILTRATION - T1041 - Exfiltration Over C2 Channel

EXFILTRATION - T1567.002 - Exfiltration to Cloud Storage

IMPACT - T1583.006 - Session Hijacking

References

[1] https://thehackernews.com/2024/12/16-chrome-extensions-hacked-exposing.html

[2] https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it

[3] https://www.infosecurity-magazine.com/news/chrome-browser-extensions-hijacked/

[4] https://www.theverge.com/2024/12/28/24330758/chrome-extension-cyberhaven-hijack-phishing-cyberattack-facebook-ads-authentication-theft

[5] https://www.virustotal.com/gui/domain/cyberhavenext.pro

[6] https://darktrace.com/blog/balada-injector-darktraces-investigation-into-the-malware-exploiting-wordpress-vulnerabilities

Continue reading
About the author
Rajendra Rushanth
Cyber Analyst

Blog

/

Email

/

March 19, 2025

Global Technology Provider Transforms Email Threat Detection with Darktrace

Default blog imageDefault blog image

At a glance

  • Within just one month of using Darktrace / EMAIL, the volume of suspicious emails requiring analyst attention dropped by 75%, saving analysts 45 hours per month on analysis and investigation.
  • By offloading most manual, repetitive tasks to Darktrace / EMAIL, the company’s skilled security analysts can focus on developing new capabilities and tackling more complex, rewarding projects.
  • Darktrace recently detected and blocked a highly sophisticated and personalized phishing email that spoofed a Microsoft SharePoint and Teams website and used advanced engineering to impersonate the school of an employee’s family member.
  • The transition from the incumbent solution to Darktrace / EMAIL was seamless and undetectable to the company’s vast of customers and partners, reinforcing the security organization’s role as a business enabler—protecting the company and reducing risk without adding friction.

Securing a complex, distributed business without disruption

The company remains at the forefront of technological innovation and transformation; however, its success and ambitions come with the challenges of managing a distributed global business—balancing digital advancements, existing technology investments, and evolving compliance requirements.

Optimizing a complex tech stack for scalable growth

The organization operates a diverse technology stack spanning Windows, Mac, Linux, and multiple cloud environments, creating a complex and challenging IT landscape. The company’s Chief Information Security Officer (CISO) emphasizes the need for efficiency and agility. “Our goal is to scale and deliver new capabilities without increasing headcount, ensuring that costs remain proportionate to growth.”

Balancing security, governance, and business agility

Committed to responsible practices, this industry leader prioritizes secure and trustworthy technology for its customers who rely on its solutions. “Balancing business agility with governance is a constant challenge," said the CISO. "There’s always a natural push and pull, which I believe is healthy—but achieving the right balance is delicate.”

Protecting critical workflows without impacting productivity

For the organization, email is much more than just a communication tool. “Email plays a critical role in our engineering workflows and is fundamental to how we build our products.” Because of this, the company is extremely cautious about implementing any solution that could introduce friction or disrupt productivity. “There is zero tolerance for disruption, which is why we take a deliberate and methodical approach when evaluating, selecting, and deploying our tools and solutions,” he said.  

More than a vendor: A security partner invested in success

To ensure an optimal security infrastructure, the enterprise security team regularly evaluates market technologies to their existing solutions. With the rapidly evolving threat landscape, the CISO said they “wanted to validate whether we still had best-in-class protection and the right controls in place to secure our organization. It was about assessing whether we could do better in our ongoing effort to fine-tuning our approach to achieve the best possible outcome.”

The team evaluated 15 different email security vendors based on the following criteria:

  1. Efficacy to detect threats
  2. Ability to integrate with existing tooling
  3. Ease of use
  4. A vendor’s approach to partnership  

They initially narrowed the list to five vendors, conducting demo sessions for deeper evaluations before selecting three finalists for a proof of value (POV). We analyzed actual malicious emails with each vendor to assess the accuracy of their detections, allowing for an objective comparison,” said the CISO. Through this rigorous process, the Darktrace / EMAIL security solution emerged as the best fit for their business. “Darktrace’s product performed well and showed a genuine commitment to partnering with us in the long-term to ensure our success.”

The team objectively understood where there were gaps across the different vendors, where they were strong, and where they could use improvement. “Based on the analysis, we knew that Darktrace / EMAIL could deliver as the data supported it, in our specific use cases.  

Partnership, integrity and respect

Throughout the evaluation process, the importance of partnership and mutual respect remained an essential factor to the CISO. “I wanted a company we could develop a long-term strategic partnership with, one that could extend far deeper than just email.” A key factor in choosing Darktrace was the commitment and engagement of its team at every level of the organization. “Darktrace showed integrity, patience and a genuine investment in building a strong relationship with my team.  That's why we're here today.”

“Together, we've delivered some fantastic outcomes”

For the organization, Darktrace / EMAIL has played a crucial role in reducing risk, empowering analysts, and enabling a lean, effective security strategy. “Together, we've delivered some fantastic outcomes,” said the CISO.  

Reducing risk. Empowering analysts

“Within that first month, we saw a 75% drop in suspicious emails that that required manual review, which reduced the time my team spent analyzing and investigating by 45 hours per month,” said the CISO. The security team values Darktrace / EMAIL not only for its ease of use but also for the time it frees up for more meaningful work. “Giving my team the opportunity to tackle complex challenges they enjoy and find more stimulating is important to me.” As they continue to fine-tune and optimize balance levels within Darktrace / EMAIL, he expects even greater efficiency gains in the coming months.

Maximizing protection while staying lean

It’s important for the security group to be proportionate with their spending, said the CISO. “It's all about what is enough security to enable the business. And that means, as our organization grows, it's important that we are as lean and as efficient as possible to deliver the best outcomes for the business.”  Embracing an AI-powered automated approach is an essential component to achieving that goal. By offloading most manual, repetitive tasks to Darktrace / EMAIL, the company’s skilled security analysts can focus on more strategic and proactive initiatives that enable the business.  

Protecting employees from advanced social engineering threats

Recently, Darktrace detected a malicious email targeting an employee, disguised as a spoofed Microsoft SharePoint and Teams website. What made this attack particularly sophisticated was its personalization — it impersonated the school where the employee’s family member attended. Unlike mass malicious emails sent to thousands of people, this was a highly targeted attack, leveraging advanced social engineering tactics to exploit connections within the education system and between family members.  

Protecting without disrupting

A seamless migration is often overlooked but is critical to success for any organization, said the CISO. With a wide ecosystem of partners, email is a highly visible, business-critical function for the organization — "any friction or downtime would have an immediate impact and could throttle the entire business,” he said. However, the transition from their previous solution to Darktrace / EMAIL was exceptionally smooth. “No one realized we changed providers because there was no disruption — no incidents at all. I cannot emphasize just how important that is when I'm trying to position our security organization as an enabling function for the business that protects and reduces risk without adding friction.”

A security partnership for the future

“To survive as a business over the next few years, adopting AI is no longer optional—it’s essential,” said the CISO. However, with the cybersecurity market becoming increasingly saturated, selecting the right solutions and vendors can be overwhelming. He stresses the importance of choosing strategic partners who not only deliver the outcomes you need, but also deeply understand your organization’s unique environment. “You’re only as strong as your partners. Technology innovation and the cybersecurity market are always changing.  At some point every solution will face a challenge—it’s inevitable. The differentiator will be how people respond when that happens.”  

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI